Kong Support

24/7 Kong Gateway Support with a 15-Minute Emergency SLA

AceMQ supports Kong Gateway in production — 502s from upstream health check and DNS caching behaviour, plugin chains adding latency to every request, rate limits that drift across nodes without a shared store, and Ingress Controller routes that never reconcile. Every ticket reaches a named senior engineer.

Senior Kong engineers on call right now — 24/7/365
15 min emergency SLA24 /7 global coverage130 + enterprise customers26 + countries served

Trusted for mission-critical Kong by teams in finance, healthcare, defense, and telecom

Escalation Path

Your first hour of a Kong outage

Most vendors publish an SLA number. This is what actually happens, minute by minute, when you page a senior AceMQ engineer.

T+0

You page us

Phone, email, or Slack — any channel reaches the on-call senior engineer directly. No web form, no tier-1 queue.

T+15

Named engineer live

A senior engineer who already knows your environment joins a live bridge. Zero cold-start, no re-explaining your topology.

T+30

Root cause isolated

Direct broker access, log and metric review, and a working hypothesis with a rollback plan before we touch anything.

Post

Written RCA

Documented root cause, the fix applied, and the prevention steps — delivered after every P1, not just when asked.

Response Times

SLA tiers, contractually guaranteed

Every tier reaches a senior Kong engineer. There is no tier-1 triage layer to get through.

P1 — Emergency
15 min

Production down, messages not flowing, cluster or broker failure

P2 — Critical
1 hour

Severe degradation, rising error rates, approaching capacity limits

P3 — High
4 hours

Performance issues, configuration problems, non-critical failures

P4 — Standard
Next day

Questions, guidance, best practices, non-urgent improvements

Incident Triage

Kong problems we fix every week

These are real symptoms from real Kong production environments — and the first thing our engineers check when one comes in.

Intermittent 502s to an upstream that is demonstrably healthy
What we check firstKong's own view of the upstream targets and its DNS resolution cache. Kong caches resolved addresses for the record TTL, so a service whose pod IPs rotate faster than the TTL leaves Kong dialling addresses that no longer exist — while a direct curl from the same node succeeds.
Typical resolution1–2 hours
Every request gained 40ms of latency after a config change
What we check firstThe plugin execution chain and its ordering on that route. An auth plugin making an external introspection call, or a request transformer running before a cheap rejection like rate limiting, makes every request pay for work that should have been short-circuited.
Typical resolution1–2 hours
Rate limits allow far more traffic than configured
What we check firstThe rate limiting policy in use. The local policy counts per node, so an eight-node cluster enforces roughly eight times the configured limit. The cluster and redis policies share state; local does not, and it is the default in many deployments.
Typical resolutionUnder 1 hour
A route change is live on one node and not on another
What we check firstCluster propagation state — control plane to data plane sync status in hybrid mode, or the database cache invalidation and db_update_frequency in traditional mode. Nodes serve stale routes until the invalidation event reaches them.
Typical resolution1–3 hours
Kong Ingress Controller is not applying a new route
What we check firstThe controller logs and the resource status, then whether the ingressClassName matches the controller's watched class. Silent no-ops usually come from a class mismatch or a plugin annotation referencing a KongPlugin object in a different namespace.
Typical resolution1–2 hours
Worker memory grows steadily until the node is restarted
What we check firstTotal route and service count against the router rebuild behaviour, plus plugin-held state. Very large route sets and frequent config changes drive repeated router rebuilds, and each worker holds its own copy.
Typical resolution2–4 hours
Upstream marked unhealthy and never returns to rotation
What we check firstActive versus passive health check configuration. With only passive checks, Kong has no mechanism to re-probe a target it has ejected, so it stays out of rotation until something else changes the config.
Typical resolutionUnder 1 hour
Client certificate or TLS handshake failures at the gateway
What we check firstSNI to certificate mapping in Kong, the trust chain configured for mutual TLS, and whether the client is presenting an intermediate. Handshake failures at Kong usually resolve to a missing intermediate or an SNI with no matching certificate object.
Typical resolutionSame day

Resolution times reflect typical Kong engagements under an active AceMQ support contract. Every P1 closes with a written root-cause analysis.

Not on the list? Tell us what's breaking
Support In Practice

Kong problems we've already solved

Representative engagements showing how these incidents get diagnosed and closed under an AceMQ support contract.

Remediation

Kong 502 and Upstream Health Check Remediation

Digital Commerce Platform

Tracing intermittent 502s at the Kong gateway to misconfigured active health checks and stale DNS resolution of upstream service names.

KongKubernetesNGINX
Read case study
Support

Kong Rate Limiting Consistency Support

B2B SaaS Provider

Fixing rate limits that allowed several times the configured quota because the plugin was using the local counter policy across a multi-node gateway.

KongRedisKubernetes
Read case study
Assessment

Kong Plugin and Latency Assessment

Payments Technology Provider

Measuring where request latency is actually spent inside the Kong plugin chain, and which plugins are worth their cost.

KongRedisKubernetes
Read case study
Support

Apigee Proxy Latency and Policy Chain Support

Telecommunications Provider

Debugging proxy-level latency and policy execution problems in Apigee that sit outside what the platform vendor's support will investigate.

ApigeeKubernetesDocker
Read case study
Remediation

Apigee Quota and Spike Arrest Behavior Remediation

Travel Booking Platform

Correcting Apigee quota and spike arrest configuration that was rejecting legitimate traffic while letting genuine bursts through to backends.

ApigeeRedisKubernetes
Read case study
Assessment

Apigee Proxy Estate and Shared Flow Redesign Assessment

Consumer Financial Services Company

Assessing a sprawling Apigee proxy estate and designing a shared flow architecture that removes duplicated policy logic across hundreds of proxies.

ApigeeKongKubernetes
Read case study
Assessment

Docker Container Security Hardening Assessment

Defense Systems Integrator

Assessing and hardening container images and runtime configuration — non-root execution, read-only filesystems, and secrets that had been baked into layers.

DockerKubernetesKong
Read case study
What's Included

Everything in your Kong support contract

No add-on pricing for incidents. No per-ticket charges. One contract covers the whole surface.

Emergency Incident Response

Gateway returning errors, upstreams ejected, config not propagating, or a plugin failing closed on every request. A senior engineer joins a live bridge within 15 minutes with access to diagnose.

Root Cause Analysis

Every P1 closes with a written RCA: what failed, why, the fix applied, and the plugin, upstream, or cluster configuration change that prevents recurrence. Standard, not on request.

Plugin Chain & Latency Tuning

Ordering the chain so cheap rejections happen first, caching auth introspection results, and profiling custom Lua plugins — cutting per-request overhead the gateway adds to every call.

Upstream & Health Check Design

Active and passive health checks, DNS and SRV resolution behaviour, load balancing algorithm selection, retries, and timeouts configured so a slow upstream degrades gracefully instead of cascading.

Auth, TLS & Security

OIDC and OAuth2 integration, key and JWT authentication, mutual TLS and certificate lifecycle, ACL design, and rate limiting that actually enforces across every node in the cluster.

Upgrades & Deployment Model

Version upgrades with rolling procedure, migration between traditional database-backed, DB-less declarative, and hybrid control-plane modes, and Kong Ingress Controller adoption in Kubernetes.

Anywhere You Run It

We support Kong wherever it's deployed

Cloud, Kubernetes, bare metal, hybrid, and air-gapped — including environments where you can't give us outbound network access.

Kong Gateway (OSS)Kong Gateway EnterpriseHybrid mode (control plane / data plane)DB-less declarative configurationPostgreSQL-backed clustersKong Ingress ControllerKubernetes & OpenShiftAWS (EC2, EKS)Microsoft Azure (AKS)Google Cloud (GKE)Bare metal & on-premiseAir-gapped / no outbound access
Why AceMQ

What you get that you don't get elsewhere

Named Engineers, Zero Cold Start

The same senior engineers stay on your account. They know your route set, your plugin chain, and your deployment mode — so a P1 call starts with diagnosis, not twenty minutes of you explaining your gateway topology.

No Tier-1 Triage Layer

You reach a senior engineer directly by phone, email, or Slack. No help desk collecting information to pass along, and no escalation approval standing between you and someone who can actually fix it.

We Diagnose Through the Gateway, Not At It

The gateway is where every problem shows up and rarely where it lives. We follow the request into DNS, the service mesh, the upstream runtime, and the database behind it — because that is where the 502 usually originates.

Lua and NGINX Level, Not Just Config

Kong is OpenResty underneath. When the answer is not in a plugin setting we read the NGINX error log, profile custom Lua, and work at the level the gateway actually runs at.

Genuine Follow-the-Sun Coverage

Engineers across 26+ countries and every time zone. Your 3am incident is someone's mid-afternoon — no overnight skeleton crew, no waiting for a region to wake up.

Proactive, Not Just Reactive

Quarterly health checks on route count, plugin overhead, upstream health, and version currency — plus alerts on CVEs affecting the exact Kong and OpenResty versions you run.

FAQ

Kong support questions

Your API Gateway Is the Front Door to Everything

Whether you need emergency response tonight or a support contract that keeps latency, routing, and rate limits predictable, AceMQ staffs every engagement with a named senior engineer. Support quotes returned within 24 hours.

Get in Touch

Talk to a Support Expert

Send us a message and we'll follow up within one business day — or book a free 30-min consultation directly.

305-204-2607
info@acemq.com
66 W. Flagler St. 9th Floor
Miami, FL 33130

Prefer to talk now? Call us directly or use the consultation tab to find a time that works.

We respond within 1 business day.

Pick a time that works — no pressure, no pitch. Just 30 minutes with an expert.

We respond within 1 business day.